Extracted

• • Target
    1111cc4e934a1ce60aae66ad8305bffbc5cd901d4f1c7ec1e62f35c7e8546c40
  • Size 45KB
  • SHA256 1111cc4e934a1ce60aae66ad8305bffbc5cd901d4f1c7ec1e62f35c7e8546c40
  • MD5 4c97dd8f0eb663b59380e7810a5482cf
  • SHA1 3d243ad3cddd751ed480170aac49064dc5dd2c4d
  • SHA512 653179af878f9d0b1919d5e74f5ed2b1b618a5445f8f56860573c2d0eade1b39b28a498fd272aa6a87b35442c6e986cfc0ffa4d3d2bc041e570c90cf6c070eed
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVeBzCQKx7PImejbTgX3iyAxnEGseBDZkx:suJdpTPdI2/o0mSbMXSyEnEGHdkx
  • TLSH
    T1EA231A003BE8C23BF2BE4FB49CF26145467BF5636603D54E2CC451975623BC68A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2